A group protects nothing until an instance uses it. Take an instance that already runs a web server (lesson 10 shows how a machine sets one up for itself) and still has only the region's default group, which allows nothing in from the internet. $ID holds its id and $IP its public IP, kept as in the Finding an Instance lesson.
Before: a timeout
curl -m 3 http://$IP/curl: (28) Failed to connect to 54.23.117.9 port 80 after 3002 ms: Timeout was reached-m 3 makes curl give up after three seconds instead of waiting. The two failures look alike and mean opposite things:
| curl says | Exit status | Means | Look at |
|---|---|---|---|
Timeout was reached | 28 | a firewall dropped the packet | the security group |
Connection refused | 7 | the packet arrived, nothing listens on that port | the program on the instance |
Attaching the group
Commands that change an instance take the group's id, not its name. Look it up and keep it, like the instance id:
SG=$(aws ec2 describe-security-groups --group-names web-sg --query "SecurityGroups[0].GroupId" --output text)aws ec2 modify-instance-attribute --instance-id $ID --groups $SG--groups replaces the instance's whole list of groups. Name every group it should keep; any you leave out are removed. Run the same curl again and the page comes back, with exit status 0.
At launch
aws ec2 run-instances --image-id $AMI --instance-type t3.micro --security-group-ids $SG --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-2}]'--security-group-ids gives a new instance its groups from the first second, so it is never open and never unreachable by mistake.